Sun Tzu 2.0: Is CyberWar the new Warfare?

QinChineseQuotesArtofWarA640x640.jpg

 

For better or worse, the multitude of networks that help keep our world interconnected is a much different place today than it was in the past. Paradoxically, the networks that provide users with a wealth of information, transactional services and the like have also been used as a battlefield to disrupt our everyday lifestyle. From obtaining general information to managing online financial portfolios to purchasing flight tickets, there has been a groundswell of disruption to access these channels.

This year alone, these major cyber events have taken place:

January 2015: Pro Russian Hackers claim success in taking down German Chancellor’s website.

February 2015: Dutch government websites go down for more than 12 hours and cite DDoS attacks as the cause.

March2015: South Korea issues a report blaming North Korea for cyber-attacks on nuclear and water power plants.

April 2015: Group Anonymous kicks off #OpIsrael by attacking all Israeli-owned cyber assets.

May 2015: Germany’s Parliament confirms sophisticated cyber-attacks on their institution.

June 2015: Security researchers reveal that Southeast Asian Governments were hit by Operation Lotus Blossom. These attacks included sophisticated intrusions.

July 2015: A major US air carrier and stock exchange stops operating for several hours citing operational problems; however, numerous questions linger about the severity and consequences of such events.

Cyberwar and its ramifications have been debated for some time and the issue has been wrought with controversy. Few would argue that cyber-attacks are not prevalent in cyberspace. However, does it amount to a type of warfare? Are we in a cyberwar?

Let’s break this down by drawing parallels from a treatise by 6th century military general, Sun Tzu, who authored one of the most definitive handbooks on warfare, “The Art of War.” His writings have been studied throughout the ages by professional militaries and can used to not only answer the question of whether or not we are in a cyberwar, but how one can fight a cyber-battle.

There are 13 elements that Sun Tzu uses to define warfare. Here are five noteworthy elements that relate to our question about cyberwar.

Element 1: The Army on the March

Sun Tzu suggests that for there to be a war, there needs to be an army on the march. This idea stems from the idea that to gain geo-political advantage, there must be an adversary to march against you.

This notion of coordination and focus is applicable to modern day cyber-attacks. And it is accepted in risk circles that there are a number of motives, which can contribute to these mass, focused attacks. One example of this is Operation Ababil. This cyber-attack lasted close to two years from 2012-2014 and targeted banks and financial institutions in the US It was purported to have originated from Iranian-backed cyber attackers who wanted to exert geo-political pressure on Western countries to ease sanctions.

Other examples exist such as the much heralded, attacks on Israel during various Gaza conflicts and those documented between Russia and the Ukraine and Russia and Georgia. Just like the Cold War was an abstract concept in which invisible hands seemed to drive motives and influence, the notion of today’s cyberwar has transcended, in many cases, to nation-state sponsorship.

Element 2: Variation of Tactics

Sun Tzu suggests that for warfare to exist the intended target must stay the same. However, tactics will change to gain more effect or efficacy. Sun Tzu also states that until the aggressor has achieved their results or has lost the will to fight, they will continue to fight endlessly and will randomize tactics within the battles themselves.

One can ask, does the current world of multi-vectored attacks seem more like warfare or a schoolyard brawl? If it were a brawl, one could assume that when emotions cooled, sounder times would prevail. However, if it is warfare, according to Sun Tzu, the attacks pervade. And right now, we see no end of cyber-attacks in sight. 

Element 3: The Use of Intelligence

Sun Tzu suggests the adversary who gains unique insight into their adversaries’ weaknesses and strengths holds the advantage in the battle therein. 

During the two decades I’ve spent in the information security space, there is no precedent, requiring companies to arm themselves with ‘intelligence.’ In the past, the term intelligence was largely reserved for nation-state activities to further knowledge in pursuit of geo-political gain. However, there is an ever increasing, call for companies to be armed with unique information on changing threats and retain that capability within their companies.

Element 4: Illusion vs. Reality

According to Sun Tzu, wars are won by perception alone. He suggests that the key in both waging war and winning war is in the finer elements of destroying an adversary’s will to fight. He also suggests that kinetic engagement is often a futile effort in destroying the will of an adversary. The victor will be he who plants the perception in the minds of the combatants that their resistance will be futile. This is imperative.

This is an essential part of warfare – combatants create psychological messaging and leverage alliances and influencers to conduct warfare. The resulting ‘image’ created from those efforts are sometimes far from the reality, yet necessary for adversaries to win wars. Given this, we have witnessed concerted efforts by today’s cyber-attackers (Anonymous Operations, LulzSec, and many more) to exact a mental toll on their intended victims even before a single attack is hurled.

Often times even just the threat of attacks can result in the aggressor gaining their concessions from their targeted victims. These efforts are now spilling over to geo-political threats on everything from the financial sectors to critical infrastructure.

Element 5: Laying Plans

Sun Tzu argues that to be the victor in warfare one must lay plans for the victory. He suggests that the most successful defense and offense of a military is achieved first through professional planning.

Before our eyes we are witnessing a dramatic change in nation-states standing up legions of newly organized Cyber warfare centers, which are designed to organize, train and equip the next generation warrior. Moreover, there is an equally impressive effort on behalf of transnational actors (e.g. Al-Qaida, ISIS, Group Anonymous, and numerous other groups) who don’t call a nation-state home. Nevertheless, they have built impressive capabilities to exact their will on others through training camps and fielding armories of newly developed weapons. Today’s threat landscape is moving quickly with offensive weapons being fielded routinely as well as innovative new ways to exploit old vulnerabilities via the use of professional planning and training.

The changes in the threat landscape and the documented attacks are more akin to warfare than random acts of thuggery. Although many of these attacks are not directed in a coordinated manner with a central authority, tactics and means often lead like-minded organizations to band together. Could this possibly be the next step in the evolution of this type of warfare?

Should this environment manifest to an all-out warfare, serious questions may arise. How capable are we to protect human safety in transportation systems? Can the integrity of our financial sector be preserved? Will the quality and the sanctity of our way of life remain preserved by of our political and governing systems? If we are not capable – what measures need to be implemented in order to protect these interests? 

Hopefully, we can abate these threats and take back the upper hand in this electronic “Sun Tzu 2.0” warfare.
Ein News: http://bit.ly/1TBm6So

 

« Hacking Critical Infrastructure: How-To Guide
When Your White Hat Is Really a Black Hat »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

StoneFly

StoneFly

StoneFly offers High Availability, high performance cluster and scale out storage, and backup and disaster recovery appliances.

Templar Executives

Templar Executives

Templar Executives is a leading, expert and dynamic Cyber Security company trusted by Governments and multi-national organisations to deliver business transformation.

Intel Capital

Intel Capital

Intel Capital, Intel's strategic investment organization, backs innovative technology startups and companies worldwide. We invest in a broad range of hardware, software, and services.

iHLS Startups Accelerator

iHLS Startups Accelerator

iHLS Accelerator is the first startup accelerator in the world in the security and homeland security field.

M12

M12

M12 (formerly Microsoft Ventures) is the corporate venture capital subsidiary of Microsoft.

Selectron Systems

Selectron Systems

Selectron offers system solutions for automation in rail vehicles and support in dealing with your railway cyber security challenges.

CloudSEK

CloudSEK

CloudSEK has set its sights on building the world’s fastest and most reliable AI technology, that identifies and resolves digital threats.

White Cloud Security

White Cloud Security

White Cloud is a cloud-based Application Trust-Listing security service that prevents unauthorized programs from running on your computers.

Greenberg Traurig (GT)

Greenberg Traurig (GT)

Greenberg Traurig, LLP (GT) is a global law firm with offices in 40 locations in the United States, Latin America, Europe, Asia, and the Middle East.

Stronghold Cyber Security

Stronghold Cyber Security

Stronghold Cyber Security is a consulting company that specializes in NIST 800, the Cybersecurity Framework and the Cybersecurity Maturity Model Certification.

Profian

Profian

Profian’s hardware-based solutions maintain your data's confidentiality and integrity in use, providing true confidential computing to meet regulatory and audit requirements.

Probity

Probity

Probity Inc. is a certified software development and systems engineering company, providing support to federal government and national defense related clients.

e-Xpert Solutions

e-Xpert Solutions

e-Xpert Solutions is a company specialized in the Information Security field since 2001. Our skills are strong technical expertise and the development of tailor-made solutions.

Network Contagion Research Institute (NCRI)

Network Contagion Research Institute (NCRI)

NCRI provides pioneering technology, research, and analysis to identify and forecast cyber-social threats targeting individuals, organizations, and communities.

Total Secure Technology

Total Secure Technology

Total Secure Technology provides trusted Managed IT Security and Managed IT Services for organizations looking to increase their cybersecurity defensive posture.

Vultara

Vultara

Vultara provides web-based product security risk management tools for electronics manufacturers.

PriorityZero

PriorityZero

PriorityZero is a European company focused on remote security assessments and consulting services that operates on a global scale.